Fix bug #80332

Author: NathanFreeman

NEWS

@@ -355,6 +355,8 @@ PHP                                                                        NEWS
 - DOM:
   . Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free).
     (Nathan Freeman)
+  . Fixed bug #80332 (Completely broken array access functionality with
+    DOMNamedNodeMap). (Nathan Freeman)
 
 - FPM:
   . Fixed bug GH-8885 (FPM access.log with stderr begins to write logs to

ext/dom/php_dom.c

@@ -1519,7 +1519,18 @@ static zval *dom_nodelist_read_dimension(zend_object *object, zval *offset, int
 		return NULL;
 	}
 
-	ZVAL_LONG(&offset_copy, zval_get_long(offset));
+	if (Z_TYPE_P(offset) == IS_STRING) {
+		zend_long lval;
+		zend_uchar type = is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), &lval, NULL, true);
+		if (type == IS_LONG) {
+			ZVAL_LONG(&offset_copy, lval);
+		} else {
+			zend_throw_error(NULL, "Cannot access node list with offset %s", Z_STRVAL_P(offset));
+			return NULL;
+		}
+	} else {
+		ZVAL_LONG(&offset_copy, zval_get_long(offset));
+	}
 
 	zend_call_method_with_1_params(object, object->ce, NULL, "item", rv, &offset_copy);
 

ext/dom/tests/bug80332.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #80332 (Completely broken array access functionality with DOMNamedNodeMap)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$doc = new DOMDocument;
+$doc->loadHTML('<span attr1="value1" attr2="value2"></span>');
+
+$x = new DOMXPath($doc);
+$span = $x->query('//span')[0];
+
+print "Node name: {$span->nodeName}\n";
+print "Attribute [0] name: {$span->attributes[0]->nodeName}\n";
+print "Attribute [0] value: {$span->attributes[0]->nodeValue}\n";
+print "Attribute ['1'] name: {$span->attributes['1']->nodeName}\n";
+print "Attribute ['1'] value: {$span->attributes['1']->nodeValue}\n";
+print "Attribute 'hi' name: {$span->attributes['hi']->nodeName}\n";
+print "Attribute 'hi' value: {$span->attributes['hi']->nodeValue}\n";
+print "Attribute 'attr2' name: {$span->attributes['attr2']->nodeName}\n";
+print "Attribute 'attr2' value: {$span->attributes['attr2']->nodeValue}\n";
+?>
+--EXPECTF--
+Node name: span
+Attribute [0] name: attr1
+Attribute [0] value: value1
+Attribute ['1'] name: attr2
+Attribute ['1'] value: value2
+
+Fatal error: Uncaught Error: Cannot access node list with offset hi in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d